# CVE-2026-126771: OpsTree REMS stored cross-site scripting in file preview

Source: https://junglewise.ai/threats/cve-2026-126771-opstree-rems-through-1-0-0-contains-a-stored-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126771 · Severity: medium · CVSS 5.4 · Published 2026-11-11

OpsTree REMS is an AI-powered observability and monitoring platform used to track system health and troubleshoot incidents. A vulnerability in its file attachment preview feature allows authenticated users to upload malicious HTML files disguised with fake extensions, which execute JavaScript when viewed by other users, potentially stealing data or compromising accounts.

Technologies: [OpsTree REMS](https://junglewise.ai/threats/technologies/opstree-rems). Vendors: [OpsTree](https://junglewise.ai/threats/vendors/opstree).

## Quick answers

**Is CVE-2026-126771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126771 being exploited in the wild.

**How severe is CVE-2026-126771?** Medium severity, with a CVSS score of 5.4, published 11 November 2026.

**Which products and versions are affected?** OpsTree REMS through 1.0.0.

**Is there a fix for CVE-2026-126771?** No fixed version is recorded yet. Validate file extensions, MIME types, and file magic bytes server-side; reject files with multiple or misleading extensions; serve uploaded files with Content-Disposition: attachment to prevent inline rendering; store uploads outside the web root; and implement X-Content-Type-Options: nosniff and Content Security Policy headers.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126771 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126771?** Check whether you run OpsTree REMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Validate file extensions, MIME types, and file magic bytes server-side; reject files with multiple or misleading extensions; serve uploaded files with Content-Disposition: attachment to prevent inline rendering; store uploads outside the web root; and implement X-Content-Type-Options: nosniff and Content Security Policy headers.</anigation>
</invoke>

## Technical details

Stored XSS in the attachment upload and preview functionality results from insufficient server-side validation of file content and unsafe inline rendering of uploaded attachments. An attacker can upload HTML files with spoofed MIME types and misleading extensions (e.g., test.html.pdf) that render as HTML when previewed, executing arbitrary JavaScript in victims' browsers within the REMS origin. Authentication and user interaction (file preview) are required.

## Affected products

- OpsTree REMS through 1.0.0

## Timeline

- 2026-09-20: disclosed
- 2026-11-11: advisory

## References

- [https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b](https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b)
- [https://opstree.com/rems-ai-powered-observability/](https://opstree.com/rems-ai-powered-observability/)

## Related threats

- [OpsTree REMS incorrect comment attribution](https://junglewise.ai/threats/cve-2026-126772-opstree-rems-through-1-0-0-contains-an-improper-attribution)
- [OpsTree REMS server-side request forgery in database test connection](https://junglewise.ai/threats/cve-2026-126770-opstree-rems-through-1-0-0-contains-a-server-side-request)
- [OpsTree REMS prompt injection vulnerability in RCA Chat](https://junglewise.ai/threats/cve-2026-126767-opstree-rems-through-1-0-0-contains-a-prompt-injection)
- [OpsTree REMS improper authorization in incident creation](https://junglewise.ai/threats/cve-2026-126766-opstree-rems-through-1-0-0-contains-an-improper-authorization)